cisco l2tp ipsec vpn, разграничения для клиентов по подсетям

В офисе завалялся Cisco router 2611, это модель начала 2000 годов, решили сделать из него VPN gate. Скорее всего конфиг подойдет и для других Cisco. На нашей 2611 System image file is "flash:c2600-advsecurityk9-mz.124-18.bin", на всякий случай.
Суть: пользователь i_ivanov подключаясь получает адрес из пула VPN-POOL-1,
пользователь n_romanov подключаясь получает адрес из пула VPN-POOL-2.

Для этих пулов разные права доступа - см. ip access-list extended office_and_tech.
vpn-gate#sh run
Building configuration...

Current configuration : 3734 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname vpn-gate
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
enable secret 5 $1$Q/p7$AFkWerymo9xG1/h.g/NdB3.
!
aaa new-model
!
!
aaa authentication ppp VPDN_AUTH local
aaa authorization network VPDN_AUTH local
!
aaa attribute list ATTR-LIST-2
 attribute type addr-pool "VPN-POOL-2" service ppp protocol ip
!
aaa attribute list ATTR-LIST-1
 attribute type addr-pool "VPN-POOL-1" service ppp protocol ip
!
aaa session-id common
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
ip domain name domain.name.local
vpdn enable
!
vpdn-group L2TP
! Default L2TP VPDN group
 description Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 no l2tp tunnel authentication
!
vpdn-group L2TP2
 description Default L2TP2 VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 2
 no l2tp tunnel authentication
!
!
!
!
!
username admin privilege 15 secret 5 $1$N5A.$2H.pEryBrQwmTFiAD93/
username i_ivanov password 7 1133101712051F5A53333E
username i_ivanov aaa attribute list ATTR-LIST-1
username j_johnson password 7 1423171915087205147D040725
username i_ivanov aaa attribute list ATTR-LIST-2
username v_lenin password 7 10400810161E17532D
username v_lenin aaa attribute list ATTR-LIST-1
username l_trotskiy password 7 09674F1B1808151D075F500A
username l_trotskiy aaa attribute list ATTR-LIST-1
username n_romanov password 7 013B14100C535502356C
username n_romanov aaa attribute list ATTR-LIST-2
username queen_victoria password 7 09494B1A1C0C0F1B0E
username queen_victoria aaa attribute list ATTR-LIST-1
archive
 log config
  logging enable
  hidekeys
 path tftp://192.168.2.1/cisco_2611/cisco_2611
 write-memory
 time-period 10080
!
!
controller E1 0/0
!
ip ssh version 2
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key YOUR_SECRET_KEY address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set L2TP-Set2 esp-3des esp-sha-hmac
 mode transport
!
crypto dynamic-map dyn-map 10
 set nat demux
 set transform-set L2TP-Set2
!
!
crypto map outside_map 65535 ipsec-isakmp dynamic dyn-map
!
!
!
interface Loopback1
 description loopback for IPsec-pool
 ip address 192.168.19.1 255.255.255.255
!
interface Loopback2
 description loopback for IPsec-pool2
 ip address 192.168.19.65 255.255.255.255
!
interface FastEthernet0/0
 ip address 8.8.8.8 255.255.255.252
 ip access-group office_and_tech out
 no ip route-cache cef
 duplex auto
 speed auto
 crypto map outside_map
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Virtual-Template1
 ip unnumbered Loopback1
 peer default ip address pool VPN-POOL-1
 ppp authentication ms-chap-v2 VPDN_AUTH
 ppp authorization VPDN_AUTH
!
interface Virtual-Template2
 ip unnumbered Loopback2
 peer default ip address pool VPN-POOL-2
 ppp authentication ms-chap-v2 VPDN_AUTH
 ppp authorization VPDN_AUTH
!
ip local pool VPN-POOL-1 192.168.19.5 192.168.19.62
ip local pool VPN-POOL-2 192.168.19.70 192.168.19.126
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 8.8.8.1
!
no ip http server
no ip http secure-server
!
ip access-list extended office_and_tech
 permit ip host 8.8.8.8 any
 permit ip 192.168.19.0 0.0.0.255 172.16.0.0 0.15.255.255
 permit ip 192.168.19.0 0.0.0.63 192.168.0.0 0.0.255.255
!
access-list 23 permit 192.168.2.0 0.0.0.255
!
!
control-plane
!
!
!
!
line con 0
line aux 0
line vty 0 4
 access-class 23 in
 exec-timeout 60 0
 logging synchronous
 transport input ssh
 transport output ssh
!
!
end

Отправка писем с вложением из консоли. Mutt.

echo "Текст письма" | mutt -a "/path/to_file/attachment.txt" -s "subject of message" -- user@mail.com

Чтобы работало нужен настроенный MTA - ssmtp или sendmail, ну и собственно mutt.